It seemed harmless enough. Mrs Bodil Lindqvist, a Swedish lay preacher, set up her own website after attending an IT course. On the site she included some local church gossip. The gossip was not particularly malicious but when there were complaints, she took the site down immediately. Sadly, this was not enough for the local Swedish prosecutor, who charged Lindqvist with contravening European Union data protection rules (which apply in the United Kingdom as much as they do in Sweden) by including such personal information on her web pages. This constituted a criminal offence under Swedish law.

The Swedish district court convicted Lindqvist, fining her a basic Kr100, but raised this forty-fold to Kr4,000 (roughly £310) for what it saw as the severity of the offence. She was also ordered to pay Kr300 to a fund for victims of crime. Lindqvist's case was referred to the European Court of Justice, which recently upheld the conviction. The decision will set alarm bells ringing not only for online gossip-mongers but for all those in the media. The European Court seems intent on applying data protection laws strictly to enforce a high degree of personal and privacy protection.

The pages on Lindqvist's website contained information relating to herself, her husband and some 16 of her parishioners. This included their names (although sometimes only their first name), their jobs (described, the court said, in a "mildly humorous manner"), their hobbies, their family circumstances and the fact that one parishioner had injured her foot. The Swedish court took an especially dim view of the reference to the foot injury as this constituted sensitive personal data, the use of which is particularly strictly controlled.

The European data protection directive regulates the use of personal data that is processed automatically (ie on a computer) or data contained in an appropriate filing system. All EU member states must implement the directive, although they can do so in differing ways. The directive does not, however, apply to "purely personal or household activity". Lindqvist argued that the material on her website was "purely personal" in that it had not been placed there for commercial purpose. For this reason, she said, her conviction should not stand.

But the European court held that this exemption applied only to activities solely carried out in the course of private or family life. It did not apply to publication on the internet because material placed on the web would be available to an indefinite number of people.

To lawyers in Britain, where we have no tradition of a legal right to privacy, this seems a strange development. Lindqvist's internet postings were relatively anodyne and any concern regarding them would appear to be met by the removal of the material when complaints were made. Her conviction with a fine and a criminal record looks extremely heavy-handed.

But many lawyers elsewhere in Europe would see things very differently. Most European countries have extensive privacy and personality rights written into their constitutions. Continental lawyers would think there is nothing odd about a person being prosecuted for an unwarranted use of some else's personal information.

The European data protection rules are implemented into UK law under the Data Protection Act of 1998. Under this act, the use of personal data will not usually give rise to criminal liability, even if the use contravenes the requirements of the act. However, there may be civil liability for compensation or an injunction if personal data is used improperly.

There has been relatively little litigation over the act as yet but many media lawyers anticipate that it will, in the future, be used to extend rights not only in privacy but also to develop image and personality rights. Such rights would allow a famous person much greater ability to control the use of his or her image, name or personality and would potentially provide a further lucrative income for celebrities for such use.

This has already occurred on the continent. In Spain, the Real Madrid striker Raul brought a successful claim against a television company, under his constitutional right to his image, for compensation for the use of short clips of him playing in promotional trailers for football matches. This was despite the fact that the company owned the rights to broadcast the matches and, of course, that the player was handsomely remunerated for playing in them. Similarly, in Germany, the Bayern Munich goalkeeper Oliver Kahn was able to prevent his image being used in a football video game on the basis of his right to his image.

In the UK, there is an exemption from most data protection obligations where the data is used for artistic, literary or journalistic purposes. However, this exemption applies only where the user of the data reasonably believes (among other things) that the use of the data in question was in the public interest. With the courts increasingly prepared to recognise privacy and personality rights, media organisations may find it harder and harder to justify that they thought a public interest existed.

Perhaps the most important feature of these data protection laws from a domestic perspective is that they reverse the burden of proof. Instead of, as previously, a claimant having to show that a certain invasion of privacy or use of his or her name or image was unwarranted, now he or she merely has to show that personal data has been used and leave the perpetrator to justify the use. Under the legislation, this can be very hard to do.

The potential pernicious effect of these data protection laws was seen last week in the aftermath of the Soham trial, where Humberside police claimed that they had been prohibited under these laws from keeping details of allegations of sexual assault made against Ian Huntley. The Information Commissioner said that this was in fact a misunderstanding and that such details could be retained. Nonetheless, the influence of the laws is clearly not always in the public interest.

The Lindqvist decision is important because it shows the way the judicial wind is blowing. With this and yet further data protection legislation expected from Europe, it seems that, sooner or later, the broad privacy and image right protection so common elsewhere in Europe may well be foisted upon us here.